statamic/cms · Security
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- GHSA ID
- GHSA-j2vp-f2pv-5rj4
- CVE ID
- CVE-2026-64663
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Description
Impact
Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.
Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.
Patches
This has been fixed in 5.74.1 and 6.24.0.
CWEs
- CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')